Search code examples
c#c++cwindowsreadprocessmemory

ReadProcessMemory entire process


I'm trying to read an ENTIRE process with ReadProcessMemory but for some reason no matter what, trying to read at low addresses causes the function to fail.

For example, if I'm reading from a process, I can access areas of its memory without a problem. But the lower addresses of the process, like 0, can't be accessed and ReadProcessMemory fails on those.

Is there some privileges I need to be able to access the ENTIRE process with ReadProcessMemory?


Solution

  • Some memory pages are intentionally set to unreadable, especially the first page, because that detects a lot of programming errors.

    You can determine if you are able to read the memory page in another process with VirtualQueryEx.

    To determine the size of the memory page use GetSystemInfo.

    You have to read the memory page by page.

    Also, check out this article that explains why you should not use IsBadReadPtr instead of VirtualQuery: IsBadXxxPtr should really be called CrashProgramRandomly